On Tue, 2007-10-16 at 10:10 -0600, Ashley M. Kirchner wrote: > In terms of performance and when a packet is dropped or denied, > what's best to use? iptables or hosts.deny ? Let's assume for a > moment here that one has a very long list of IP ranges that are being > blocked, would using iptables to deny the ranges work better/faster > than having hosts.deny block them? Just wondering ... If iptables is running, then it's already had a look to see whether to let the traffic through, or not. Might as well make a decision about not letting it through, at the same time. I'd think that firewalling would be better, anyway. Firewalling is stopping traffic getting in or out, whereas hosts deny/allow is dealing with something that's already got part way in. -- [tim@bigblack ~]$ uname -ipr 2.6.22.9-91.fc7 i686 i386 Using FC 4, 5, 6 & 7, plus CentOS 5. Today, it's FC7. Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists.
